Privacy Policy
Last updated: October 19, 2026
1. Privacy at a Glance
The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any information that can be used to identify you personally.
Data controller: Bastian Matzen Alma – Softwareentwicklung Kienitzer Str. 113 12049 Berlin, Germany Email: legal@alma-app.eu
2. Hosting
This website is hosted via Firebase Hosting (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you visit this website, Google’s servers may process your IP address and standard access data to deliver and secure the service. All data is transmitted over an encrypted TLS/HTTPS connection. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable provision of this website). Google is certified under the EU–US Data Privacy Framework.
3. Your Rights
You have the right to obtain free information about your stored personal data, its origin, recipients, and purpose at any time, as well as the right to rectification, deletion, and restriction of processing. You also have the right to data portability and the right to object to processing.
If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with a supervisory authority. The competent authority for Berlin is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.
For data protection enquiries: legal@alma-app.eu
4. Data Collection on This Website
Encrypted transmission
All communication between your browser and this website is transmitted exclusively over an encrypted TLS/HTTPS connection, protecting your data from unauthorised access during transit.
Server log files
The hosting provider automatically collects and stores information in server log files that your browser transmits automatically. This includes: browser type and version, operating system, referrer URL, hostname, time of the server request, and IP address. This data is not merged with other data sources and is deleted after no more than 30 days. The legal basis is Art. 6(1)(f) GDPR.
Cookies
This website uses only technically necessary functions. No tracking or advertising cookies are set. When you submit the contact form, Cloudflare Turnstile may store a temporary value in browser storage for bot protection purposes. No cookie consent banner is required.
Contact form
When you send a message via the contact form, we collect your name, email address, and message. This data is transmitted over an encrypted connection to a Firebase Cloud Function hosted in Frankfurt/Main (EU) and forwarded to us by email. It is used solely to respond to your enquiry and is deleted once the enquiry has been fully resolved, and no later than 90 days after receipt. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in handling your request).
Newsletter
If you opt in to our newsletter via the contact form, we store your email address to send you product updates about Alma. This data is used exclusively for this purpose and is not shared with third parties. The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time by emailing legal@alma-app.eu. Your email address will be deleted promptly upon withdrawal. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Buying gifts
When you buy Alma Safety Net as a gift on this website, we process your email address, optionally your first name, the chosen period, the time you accepted the terms, and the country we derive from your IP address (for price and sales area). We also use your IP address briefly to limit the number of requests and prevent abuse. Payment is handled by Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands). Mollie processes your payment data as an independent controller, see Mollie’s privacy statement. We send the order confirmation, gift code and invoice via Mailgun (Sinch, servers in the EU). The legal basis is Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (legal obligation) for invoices, and Art. 6(1)(f) GDPR for preventing abuse. We keep invoices and the related payment data for 8 years from the end of the calendar year (§ 147 AO, § 14b UStG) and delete them afterwards.
5. Third-Party Services
Umami
This website uses Umami (Umami Software, Inc., 28 Geary St, Suite 650 #243, San Francisco, CA, USA) to measure how the website is used. Umami records page views, clicks on buttons such as the app store links, the referring website, browser, operating system, device type, screen size, language and the country, which is derived from the IP address. Umami sets no cookies, stores nothing in your browser and does not create profiles across websites or devices. According to Umami, the data is anonymised and does not allow individual visitors to be identified. Umami processes the data on our behalf under a data processing agreement. The data is stored in the EU (Frankfurt, Germany). Because Umami is a US company, access from the USA cannot be ruled out. This is covered by the EU standard contractual clauses. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding which pages and buttons are used, so that we can improve the website). For more information, see the Umami privacy policy.
Cloudflare Turnstile
The contact form is protected from spam by Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Turnstile analyses visitor behaviour to distinguish humans from automated bots without displaying a traditional CAPTCHA image. Your IP address and browser information may be processed in this context. Cloudflare is certified under the EU–US Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting this website from abuse and spam). For more information, see the Cloudflare Privacy Policy.